.png)
Book a demo
Talk to us about our industry-leading CDR solutions
.png)
What is Secure by Design, and why is it important?
Secure by Design is a software development approach that requires developers to continuously test, perform authentication safeguards and adhere to programming best practices from the very beginning of product development.
This approach aims to ensure any software or hardware is brought to the market free from security vulnerabilities and unappealing to threat actors.
At Glasswall, we understand the need to adhere to best practices throughout the product development cycle. We place importance on adhering to the Secure by Design principles, as well as other quality control methods, such as the Inspection and Sanitization Guidance (ISGs) by the NSA, to ensure the integrity of our suite of zero-trust Content Disarm and Reconstruction (CDR) solutions.
What are the Secure by Design principles, and how does Glasswall adhere to them?
The UK Government Secure by Design development model details ten core principles that organizations delivering digital services should follow. These principles were derived from and expanded on the NCSC’s Secure Design Principles for Cyber Secure Systems to cover the whole product development life cycle.
Principle 1: Appoint a business risk owner
The first principle of Secure by Design requires organizations to appoint an ‘appropriately senior risk owner’. This person should either be a part of, or a direct report into the senior leadership team.
Impact:
Organizations can ensure cyber security risks are escalated to senior management and that they are dealt by the most senior stakeholders in relation to the organisation’s risk appetite.
How Glasswall adheres to this:
Our specialist engineering team reports on risks identified within the product development process directly to our Chief Product Officer (CPO), who is a member of our senior leadership team. Our CPO has significant experience in bringing software to the market and is responsible for setting risk tolerance and quality control measures throughout the organization’s product development and engineering teams. This ensures the individual best placed to deal with risks identified by the product development and engineering teams receives risk information quickly.
Principle 2: Perform security due diligence
Principle two requires organizations to continually assess the security of products or open-source code for security vulnerabilities and mitigate the risks to their environment.
Impact:
Continuously reviewing technology products and open-source code allows organizations to make informed business decisions on the trade-offs between cyber security implications and product usability.
How Glasswall adheres to this:
As an organization, we take continuous due diligence seriously. We have dedicated teams across the organization responsible for continuous testing and monitoring of our technology's protection capabilities, source code integrity, solutions useability and the wider threat landscape to ensure Glasswall CDR effectively mitigates against risks posed to our clients.
Principle 3: Design risk driven security
This principle requires organizations to continuously optimise security controls, taking into account their risk appetite, structural awareness and supply chain shared responsibility model, without overlooking relevant best practice protections.
Impact:
This principle allows organizations to dynamically manage risks and design proportionate safeguards that allow solutions to respond to changes in risk appetite, ensuring users always have an appropriately secure solution in place.
How Glasswall adheres to this:
Our technology has been designed to be deployable into environments of varying degrees of risk and structure. Glasswall CDR is currently deployed within many sensitive networks and high assurance solutions, as well as many other commercial organizations with a lower risk threshold. Our product development teams have ensured that our technology can be adjusted to match the risk appetite of the organization deploying it.
Our Policy Management API gives security teams the capability to configure content management policies to match their organization’s risk appetite, allowing them to govern the treatment of files and their contents during the CDR process.
Principle 4: Create usable security
Here, organizations are expected to carry out ongoing user research to ensure security controls are appropriate and deemed easy to use.
Intent:
Users operate security controls most effectively if a solution has been designed to be as user-friendly as possible. Security teams are more likely to engineer inefficient and insecure workaround practices if a solution is difficult to use.
How Glasswall adheres to this:
Security teams need no longer choose between complete file security or speed and usability. User experience (UX) is considered a critical component of the product development process at Glasswall. Our experienced UX team continuously tests, analyzes and updates new and existing products in accordance with real world user feedback and in-house user testing, ensuring a seamless user experience across our range of Content Disarm and Reconstruction solutions.
Principle 5: Design security considering detective and responding measures
Principle 5 requires organizations to design and iterate security controls and processes to cover all stages of the service life cycle including capabilities to protect, detect, respond and recover from incidents.
Intent:
By designing for security capabilities expanding across all functions of the cyber security framework, organizations reduce the likelihood of weak points where compromise could occur and go undetected.
How Glasswall adheres to this:
Our product development efforts place great importance on developing solutions that cover all stages of the cyber security service life cycle. This allows us to offer our customers solutions that boast holistic file protection capabilities – without protection gaps that could significantly impact their organizations.
Our patented 4-step CDR process has been designed to fulfil all functions required by the cyber security framework, including:
Protect – Users are protected from ingesting malicious content or from sharing sensitive or harmful data by our zero-trust file protection technology.
Detect – While a reliance on detection of malicious content can only protect organizations against threats that have been seen before, our patented Content Disarm and Reconstruction technology can identify vulnerabilities and non-conforming document structures by comparing it to manufacturer's ‘known-good’ specifications.
Respond and Recover – Glasswall CDR uses a patented 4-step process that responds to threats by rebuilding files back to their manufacturer’s known-good specification – making it difficult for threat actors to hide malware and increasing the likelihood of it being detected by other systems. In addition, security teams are provided with real time and post-processing reporting data to ensure they can address any vulnerabilities found elsewhere in their security architecture.
Principle 6: Design flexible architectures
Principle six requires developers to implement flexible architectures for both legacy systems and new services that allow scaling and easy integration of new security controls in response to business requirements, changing threats and vulnerabilities.
Intent
The use of flexible architectures allows solutions to quickly respond to changes in the risk landscape and adapt to meet ever-changing business demands.
How Glasswall adheres to this
The Glasswall CDR Platform/Glasswall Halo is built on a Kubernetes architecture that provides organizations with a zero-trust file protection solution that can scale infinitely to meet demand. The solution’s OpenAPI specification-compliant design provides developer-centric web services, while open-source connectors provide security teams with easy on-premises and cloud integration capabilities.
Principle 7: Minimise the attack surface
This principle requires developers only to use the required software, capabilities, data and hardware components necessary to achieve its intended purpose.
Intent
The purposed of principle seven is to minimize the attack surface without reducing service offering. This reduces the opportunity for threat actors to exploit vulnerabilities in the service.
How Glasswall adheres to this
Glasswall CDR solutions are designed to be as lean as possible to minimize the potential attack surface available to threat actors. In addition to this, our Content Disarm and Reconstruction solutions have been designed this way to maximize solution performance, scalability and deployment capabilities.
Our range of APIs allow for simple integration with other solution architectures, including hardware-based and high-assurance solutions. This means deployments can easily and simply utilize Glasswall Content Disarm and Reconstruction capabilities without unnecessarily bloated source code or features.
Principle 8: Defend in depth
Here, developers are required to assume any part of the service could be compromised at any point in its life cycle. This principle demands that services are designed so they cannot be wholly compromised if a single control has either failed or been overcome by an attacker.
Intent
By utilising layered controls effectively, it will increase the time and effort required by threat actors to fully compromise the service.
How Glasswall adheres to this:
At Glasswall, we follow a zero-trust methodology to file protection. A successful zero-trust strategy cannot consist of a single standalone security product, and instead, we adopt, via our partner network and API integration capabilities, a layered approach that is not just focused on technology but also on minimizing the impact of human error.
Principle 9 - Build and embed continuous assurance
This principle requires cyber solution developers to Implement proportionate and evidence-based security assurance into the digital service life cycle to provide confidence in the effectiveness of security controls.
Intent
Continually assuring the security posture of digital services provides the risk owners with a level of confidence that services operate securely and as intended.
How Glasswall adheres to this
Because Glasswall Content Disarm and Reconstruction is utilized by a number of bespoke high assurance solutions that operate within UK, US and other government networks, security assurance is not only just of interest internally, but externally too.
In order to operate in environments that are governed by guidance from bodies such as the NCSC and the NSA, we not only have to provide security assurance information within the initial sales process but also on an on-going basis to ensure that these highly classified networks are provided with the highest levels of security.
Principle 10 - Secure changes
The final Secure by Design principle requires organizations to assess the security impact of any proposed changes to digital services to ensure that their security and the way they work are not adversely affected.
Intent
This is to ensure that changes cannot be made to an operational service without proper consideration of how a change might affect its security, and management of that change through a secure design, development and deployment process.
How Glasswall adheres to this:
At Glasswall, we have strict processes that govern how changes to our core capabilities are considered. Our Engineering team are responsible for testing and identifying any limitations caused by proposed changes to our technology. If any changes are identified during the testing process, these are immediately escalated to the Chief Product Officer for review.
In addition, our UX team are responsible for reviewing updates and product changes to ensure that product usability is not adversely by proposed changes.
How Glasswall Content Disarm and Reconstruction Technology Instantly Removes Risk
Our patented CDR process has been designed in accordance with Secure by Design principles. Its patented 4-step process to rebuild files back to their manufacturer’s known-good specification is the heart of our range of CDR solutions. Here’s how it works:
Known-good manufacturer’s specifications matter - here’s why
Our commitment to returning all files to their manufacturer’s known-good specification sets Glasswall apart. Other CDR providers either flatten a file or use non-proprietary libraries to rebuild the file in question. There are problems with each approach. With file flattening, where a document is converted into an image-based format, the process removes all usability of the original document. In addition, non-proprietary libraries do not always conform to the known-good manufacturer’s specifications, so the rebuilt file’s structure does not meet published security standards.
Returning all files back to their manufacturer’s know-good specification and reducing the risk posed by risky file structures, users can access files with full confidence.
